fix(bridge): the transport is the bridge index.html installs, in tests too

[cryptskii]

What

Every transport path branched on window.DsmBridge.__callBin, a function only the jest stub installed: sendBridgeRequestBytes, callBoundaryMethod and callHostMethod each tried it first and fell back to sendMessageBin, the MessagePort transport public/index.html installs — so the transport the tests exercised was not the one the app runs.

Now the transport is the bridge index.html installs and nothing else: sendMessageBin for RPCs (its BridgeRpcResponse unwrapped as posted), startup / ingress / hostRequest for the boundaries (a wrapper failure reaches bridge.error as its message and propagates), __binary for readiness. AndroidBridgeV3 is exactly the seven members index.html installs.

Deleted

• The pre-wait for dsm-bridge-ready under a 2.5 s timer — redundant: sendMessageBin waits for the port itself.
• maybeUnframe, a 4-byte length-prefix guess in either byte order: Kotlin never length-prefixes, and no BridgeRpcResponse (its first byte is a field tag) can begin with its own length, so the guess never fit a real answer. Dead code, deleted rather than tested — a control that re-adds it stays green, as it must.
• The __callBin fallbacks and the request re-encoders in the two boundary files; isNativeHostUnavailableError's match on a test stub's error text; the phantom declarations in bridgeTypes.ts and globals.d.ts (including a dsmBridge global the bridge gate bans).

Tests

The jest setup completes any test bridge that supplies sendMessageBin with the same startup/ingress/hostRequest composition index.html uses (reading sendMessageBin at call time), so every suite runs the production transport; the 20 test bridges now supply sendMessageBin, and two that also carried a sendMessageBin delegating to the phantom lost it. Three suites that had pinned the fallback's behaviour now assert what production does (invalid bridge response for <method>; a boundary failure on bridge.error as its message).

ci/bridge_rpc_names.py also holds the type's members equal to the keys index.html installs, and refuses a production source naming __callBin.

Verification

• jest: 123/123 suites, 834/834 tests. tsc and lint clean. npm run build exit 0.
• Mutation controls, each red on its named test: a fallback re-encoding the request in place of the bridge's ingress; a bridge without the port transport accepted. Gate controls, each failing naming the offender: a phantom member on the bridge type; a production source naming __callBin. Files restored byte-for-byte.
• Purity, flow, scan, forbidden-symbol, bridge-contract, codegen, proto-guard, safety and bridge-RPC-name gates: all exit 0.

Recorded in CONFORMANCE_GAPS.md §6.29. Still Open there: index.html's sendMessageBin rejects a request after 30 minutes on a wall-clock timer, and its port handler tells a response from an async event by whether the first eight bytes match a pending id — transport-side, fail-closed, unchanged here.